This should be fixed in harfbuzz 1.1.3 (see bug 1228540, which landed for mozilla-46).
If you want to patch the problem locally for a mozilla-45 build, you can just do
- void (*array[]) (void);
+ void (*array[1]) (void);
at gfx/harfbuzz/src/hb-font-private.hh:83.

I am sorry, I think I told you fibs in Comment 1 and Comment 2 and thus in Comment 7...
The two header files have changed in the standalone library (it's the *.cc files that haven't changed) !
So, I suppose this bug can be closed after the two fixes in Comment 4 and Comment 5 are backported to the 45 branch or preferably a whole harfbuzz update to latest version 1.2.7 code is committed. And thanks Jonathan for pointing that out !
I have no write access to the 45 branch tree, can you Jonathan actually fix the code in the repository and close this bug ?

Created attachment 8752592[details][diff][review]
Backport fix for erroneous 'flexible array member in union' to harfbuzz 1.1.0 on esr45, to avoid compilation failure with stricter compilers
If we're going to fix this on the esr45 branch, for the sake of people wanting to build with gcc6 (or other strict compilers), we should also remove the definition of VAR from hb-opentype-private.h, as the one in hb-private.h will cover all uses. So this is the patch I suggest for esr45, cherry-picked from upstream commit a13b023d.

Jeff, just wondering why the r-? You don't think we should bother to try and fix this for esr45 (I realize it'd still be up to esr drivers to decide whether to take it), or some other issue with the patch?

Comment on attachment 8752592[details][diff][review]
Backport fix for erroneous 'flexible array member in union' to harfbuzz 1.1.0 on esr45, to avoid compilation failure with stricter compilers
[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration: Currently, the esr45 code fails to build with gcc6 because of a C++ language violation in harfbuzz code. It was fixed upstream 5 months ago (so we already have the fix in central/aurora/beta, as part of a full library update).
The patch here just cherry-picks the minimal fix from upstream. There is no change in behavior, so this avoids any potential risk of backporting the full library update just to resolve the build failure.
User impact if declined: build failure on systems with gcc6
Fix Landed on Version: on mozilla-46, we took a full harfbuzz update that includes this fix (and much more)
Risk to taking this patch (and alternatives if risky): minimal - no behavior change
String or UUID changes made by this patch: none